TESTHEON Practice Lab
AdvancedPW-AUTH-00340 minutesPlaywright

Verify a role-based 403

An authenticated Customer must not use a Manager-only route.

  • authentication
  • api
  • authorization

Objective

What to automate

Authenticate as standard_user, call the Manager-only API, and verify 403.

Preconditions and test data

Preconditions

  • Use a fresh isolated Practice Lab browser context.
  • Open the fixture identified by FX-AUTH-001.

Test data

  • standard_user
  • Practice@123

Expected result

The protected route returns 403 with an authorization error, not 401.

Open practice pageRead related guide

Progressive hints

Hint 1

Authenticate before calling the protected route.

Hint 2

Retain the auth cookie or bearer token.

Hint 3

Assert both status 403 and the stable error code.

I’ve tried it — show solution
  1. Authenticate before calling the protected route.
  2. Retain the auth cookie or bearer token.
  3. Assert both status 403 and the stable error code.